{"id":"CVE-2026-126361","aliases":["GHSA-mh32-jxcr-mh9f"],"title":"Astro: XSS via attribute injection in dynamic tag names","titleSource":"GitHub_M","descriptionSource":"OSV","declaredSeverity":"LOW","description":"## Summary\n\nWhen a dynamic tag (`const Tag = ...; <Tag />`) resolves to a string, Astro renders it as a raw HTML element name. The name was filtered to remove characters that could inject attributes, but the filter did not handle `/`. Because HTML parsers treat `/` inside a tag as an attribute separator, a tag name such as `img/src/onerror=alert(1)` was rendered as an `<img>` element with an `onerror` attribute. The JSX renderer used for MDX did not filter string tag names at all.\n\nFor example:\n\n```astro\n---\nconst Tag = Astro.url.searchParams.get('as') ?? 'div';\n---\n<Tag>hello</Tag>\n```\n\nrendered `?as=img/src/onerror=alert(1)` as live HTML.\n\n## Impact\n\nReflected or stored cross-site scripting, but only in applications that use untrusted input (such as a request parameter or an uncontrolled CMS field) as all or part of an element name. Astro itself never derives element names from request data.\n\nApplications that let content choose an element should map that input to a fixed set of known tags. Letting untrusted input choose an element name is unsafe even with a correct filter, because it can still select elements such as `script` or `iframe`.\n\n## Affected versions\n\n`astro` <= 7.4.4.\n\n## Patches\n\nFixed in `astro` 7.4.5. String tag names in `.astro` dynamic tags, JSX, and MDX now render only the leading valid element name, so characters such as `/` or `=` can no longer change the generated markup. Strings that do not start with a valid element name now throw an error.\n\n## Workarounds\n\nUpgrade to `astro` 7.4.5 or later. Before upgrading, do not use untrusted input as an element name, or map it to a fixed set of known tags.\n\n## Credits\n\nReported by @uttej-badwane.","severity":"low","score":2.3,"published":"2026-11-12T22:26:35.206Z","modified":"2026-11-13T19:15:05.517Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"npm","name":"astro","sources":[{"name":"OSV · GHSA-mh32-jxcr-mh9f","url":"https://osv.dev/vulnerability/GHSA-mh32-jxcr-mh9f"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"7.4.5"}],"type":"SEMVER"}],"versions":[],"fixed":["7.4.5"]}],"sourceAffected":[],"references":["https://github.com/withastro/astro/security/advisories/GHSA-mh32-jxcr-mh9f","https://github.com/withastro/astro/pull/18520","https://github.com/withastro/astro/commit/e023abac912d7cb6af2b9fb5107ef5dabc667096","https://github.com/withastro/astro/releases/tag/astro@7.4.5","https://nvd.nist.gov/vuln/detail/CVE-2026-126361","https://github.com/withastro/astro"],"sources":[{"name":"CVE","id":"CVE-2026-126361","modified":"2026-11-12T22:26:35.206Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-126361"},{"name":"OSV","id":"GHSA-mh32-jxcr-mh9f","modified":"2026-11-13T19:15:05.517735570Z","url":"https://osv.dev/vulnerability/GHSA-mh32-jxcr-mh9f"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","score":2.3},{"source":"OSV","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","score":2.3}],"cve":{"records":[{"id":"CVE-2026-126361","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-10T21:12:01.228Z","published":"2026-11-12T22:26:35.206Z","modified":"2026-11-12T22:26:35.206Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-11-12T22:26:35.206Z"}],"references":[{"url":"https://github.com/withastro/astro/security/advisories/GHSA-mh32-jxcr-mh9f","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/withastro/astro/pull/18520","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/withastro/astro/commit/e023abac912d7cb6af2b9fb5107ef5dabc667096","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/withastro/astro/releases/tag/astro@7.4.5","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-79","description":"CWE-79: Improper Neutralization of Input During Web Page Generation","source":"GitHub_M"},{"id":"CWE-184","description":"CWE-184: Incomplete List of Disallowed Inputs","source":"GitHub_M"}],"applicability":[],"prioritization":[]},"products":[{"vendor":"withastro","name":"astro","platforms":[],"versions":[{"version":"< 7.4.5","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-126361"}],"remediation":[],"observedAt":"2026-11-13T21:16:28.483Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T03:40:34.262Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-11-12T23:45:32.297Z","attemptedAt":"2026-11-12T23:45:32.297Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-12T23:45:34.770Z","attemptedAt":"2026-11-12T23:45:34.770Z"},{"source":"EUVD","status":"refresh-failed","attemptedAt":"2026-11-12T23:45:34.747Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-12T23:45:34.770Z","attemptedAt":"2026-11-12T23:45:34.770Z"}],"evidence":[],"aiSummary":null}